Vulnerabilidades de CERT/CC

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de CERT/CC: 3 registro(s), com severidade, exploração e correções.

VINCE 1 cveClient/encrypt-storage.js 1 cveClient/cveInterface.js 1

Somente exploradas (KEV) →

CVE-2026-8142 Média · 6.5 07/05/2026

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

CVE-2026-35467 Alta · 7.5 CWE-522 02/04/2026

Private Key stored as extractable in browser IndexeDB

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

CVE-2026-35466 Média · 6.1 CWE-79 02/04/2026

Stored XSS via unsanitized input from remote service

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services